php2shell: PHP runtime flaw affects ~70% of sites; Cloudflare shipped WAF rules 9 hours before disclosure
irvinebroque · x · 2026-10-21
- The php2shell vulnerability lives in the PHP runtime itself, so updating plugins won't fix it — you must patch PHP. PHP powers nearly 70% of websites, making exposure enormous.
- After the flaw leaked early, attackers began mutating payloads against the rules; Cloudflare deployed WAF rules at 03:02 UTC, roughly 9 hours before disclosure, and kept updating as variants appeared.
- A deeper technical writeup on what the team built to protect users is coming; new rules continue landing in the WAF changelog.
More from Infra
- GitHub hit by delays for Pull Requests and Webhook deliveries — DanielLockyer · 2026-10-21
- NVIDIA expands supply chain: substrate capacity to grow 2.5x, Amkor packaging up 300% — nvidia · 2026-10-21
- Node.js 24.22.1 Docker images finally published after hours-long delay — DanielLockyer · 2026-10-21
- Micron pitches co-design memory roadmap as key to meeting AI demand — BenBajarin · 2026-10-21
- Memphis votes to temporarily ban new data center construction for 135 days — Polymarket · 2026-10-21
- Micron details AI-class NAND: high-IOPS and high-bandwidth lines for KV cache and long context — BenBajarin · 2026-10-21